Vista - Which is the correct PowerShell log?

If I execute

get-eventlog -list

I see a list like the following:


PS C:\PowerShellScripts> get-eventlog -list

Max(K) Retain OverflowAction Entries Name
------ ------ -------------- ------- ----
512 7 OverwriteOlder 2,387 Application
15,360 0 OverwriteAsNeeded 2,798 PowerShell
512 7 OverwriteOlder 0 Security
512 7 OverwriteOlder 2,223 System
15,360 0 OverwriteAsNeeded 0 Windows PowerShell

Which is the correct PowerShell log? "PowerShell"? Or "Windows
PowerShell"?

Thanks

Andrew Watt MVP

I'd say "PowerShell", at least this one has recent entries on my machine.
Btw. anybody know how to delete these logs?
I still have "MonadLog" and several others that I don't need anymore.

--
greetings
dreeschkind

"Andrew Watt [MVP]" wrote:

> If I execute
>
> get-eventlog -list
>
> I see a list like the following:
>
>
> PS C:\PowerShellScripts> get-eventlog -list
>
> Max(K) Retain OverflowAction Entries Name
> ------ ------ -------------- ------- ----
> 512 7 OverwriteOlder 2,387 Application
> 15,360 0 OverwriteAsNeeded 2,798 PowerShell
> 512 7 OverwriteOlder 0 Security
> 512 7 OverwriteOlder 2,223 System
> 15,360 0 OverwriteAsNeeded 0 Windows PowerShell
>
> Which is the correct PowerShell log? "PowerShell"? Or "Windows
> PowerShell"?
>
> Thanks
>
> Andrew Watt MVP
>

> Which is the correct PowerShell log? "PowerShell"? Or "Windows
> PowerShell"?

V1.0 uses "Windows PowerShell"
Think "branding police". :-)

--
Jeffrey Snover [MSFT]
Windows PowerShell Architect
Microsoft Corporation
This posting is provided "AS IS" with no warranties, no confers rights.

Hi dreeschkind,

> I'd say "PowerShell", at least this one has recent entries on my machine.
> Btw. anybody know how to delete these logs?

AFAIR you have to delete the appropriate key under
HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog

cu

Max

On Fri, 24 Nov 2006 13:08:01 -0800, dreeschkind
<dreeschkind@discussions.microsoft.com> wrote:

>I'd say "PowerShell", at least this one has recent entries on my machine.
>Btw. anybody know how to delete these logs?
>I still have "MonadLog" and several others that I don't need anymore.

From the PowerShell command line:

[System.Diagnostics.Eventlog]:elete( "Monadlog")

and to delete the "Windows PowerShell" log:

[System.Diagnostics.Eventlog]:elete( "Windows PowerShell")

Andrew Watt MVP

On Fri, 24 Nov 2006 13:31:56 -0800, "Jeffrey Snover [MSFT]"
<jsnover@ntdev.microsoft.com> wrote:

>> Which is the correct PowerShell log? "PowerShell"? Or "Windows
>> PowerShell"?
>
>V1.0 uses "Windows PowerShell"
>Think "branding police". :-)

Interesting.

On two machines which have (one "had") both "PowerShell" and "Windows
PowerShell" the "Windows PowerShell" event log seems to be totally
ignored.

Is that expected? Presumably not ... at least by the branding police.


I'll try deleting the PowerShell one and see what happens. ... More
anon.

Andrew Watt MVP

"Andrew Watt [MVP]" <SVGDeveloper@aol.com> wrote in message
news:slpem21acjt98gbctk1373ennqmmlt58a8@4ax.com...
> Interesting.
>
> On two machines which have (one "had") both "PowerShell" and "Windows
> PowerShell" the "Windows PowerShell" event log seems to be totally
> ignored.

Same here. Entries are up-to-date in the PowerShell log while the "Windows
PowerShell" log is empty. I am running RTM bits.

--
Keith

Interesting. I'll investigate but barring any new data - whereever your
events are showing up - that's the right location. :-)

--
Jeffrey Snover [MSFT]
Windows PowerShell Architect
Microsoft Corporation
This posting is provided "AS IS" with no warranties, no confers rights.

On Fri, 24 Nov 2006 15:04:06 -0700, "Keith Hill [MVP]"
<r_keith_hill@mailhot.moc.nospam> wrote:

>Same here. Entries are up-to-date in the PowerShell log while the "Windows
>PowerShell" log is empty. I am running RTM bits.

I'm beginning to suspect that "PowerShell" belongs to RC1.

Deleting the PowerShell log,

[System.Diagnostics.EventLog]:elete("PowerShell")

and restarting the machine seems to cause PowerShell RTM to "see" the
"Windows PowerShell" log. It doesn't seem to see it without a machine
restart.

I guess that the RC2 and RTW installer didn't do the necessary to make
PowerShell "see" the new "Windows PowerShell" log rather than what I
assume was the RC1 "PowerShell" log.

Andrew Watt MVP

Thank you very much!

Oh, and btw.:

<Type>
<Name>System.Diagnostics.EventLog</Name>
<Members>
<ScriptMethod>
<Name>delete</Name>

<Script>[System.Diagnostics.Eventlog]:elete($this.LogDisplayName)</Script>
</ScriptMethod>
</Members>
</Type>

#Get-EventLog -list | ?{$_.LogDisplayName -eq 'MonadLog'} | %{$_.delete()}

Why? Because I can!

--
greetings
dreeschkind

"Andrew Watt [MVP]" wrote:

> On Fri, 24 Nov 2006 13:08:01 -0800, dreeschkind
> <dreeschkind@discussions.microsoft.com> wrote:
>
> >I'd say "PowerShell", at least this one has recent entries on my machine.
> >Btw. anybody know how to delete these logs?
> >I still have "MonadLog" and several others that I don't need anymore.
>
> From the PowerShell command line:
>
> [System.Diagnostics.Eventlog]:elete( "Monadlog")
>
> and to delete the "Windows PowerShell" log:
>
> [System.Diagnostics.Eventlog]:elete( "Windows PowerShell")
>
> Andrew Watt MVP
>